IN THE CLAIMS 



Amended claims follow: 

I . {Currently Amended) A computer program product embodied on a tangible 
eoniputtxr^ for controlling operation off! computet to detect ma! ware, 

said computer program product comprising: 

[[(H "Upending scan database code operable to maintain a pending scan database 
storing data identifying computer files that have been written to a data storage device and 
for which a scan for malware has yet to be performed, Hand j J 

[[(si) JJscanning code operable as a low priority task within a multitasking 
environment to conduct malware scanning upon computer files identified within said 
pending scan database as havingjTenjj been written to the data storage device and for 
which the scan for malware has yet to be performed; and 

file read code operable in response to a ?eau request for a computer (lie identified 
within said pending scan database to trigger said scanning code to scan said computer tile 
as a high priority task with a fust priority that is higher than a second priority of said low 
priority task, before permitting read access to said computer file . 

2 (Previously Presented) A computer program product as claimed in claim 1, further 
comprising file write code operable as a computer file is written to a storage device to 
add data identifying said computer file to said pending scan database. 

3. (Cancelled) 

4. (Original) A computer program product as claimed in claim i , further comprising 
scanned file database code operable to maintain a scanned file database storing data 
identifying computer files that have been scanned for malware. 



^ COngmah \ computei piogiam pxodnct as claimed tu claim 4 wherem saui data 
ideutsfs nig computet files that ha\ e been scanned Soi malwaie includes chtv.kss.jni data 
demed Horn said compute! files that v\eie scanned 

{> t Current! \ Amended) \ computei piogiam product as claimed m claim 
f ff uither comprising)] wherein said file tend code is further opetablc in response to 
| |aj jsaid read request for ((a]]sanl computer file to detccf[fedJJ it sard computer file is 
within saui scanned file databaseJI «md|| to recalculate a checksum \alue leealculated-toi 
said computet file and to determine that said ret.alciila.ted checksum \alue matches 
Ijthatjja stored checksum within said scanned tile database before petmitttny said read 
request. 

7 (puginal) A computer progj am pi oduct as claimed m ckum ! further comprising 
initiation code operable upon startup to detect am computer files stored on a storage 
de\ ice not included within either said pendrnti scan database 01 said scanned file database 
and to add such computer files to said pending scan dat ibase 

S (Cuirt-ntK Amended) X computei progs am product as claimed in claim 1 
wherein said mat* wait comprises one oi more of 

[[(i) |]a computer file infected with a computer \uus 

j| (si) |]a Tropin: 

ffUri ) ]]a banned computer file, and 

) jja computei file containing banned content 

^ {Curiemh Amended) A method tor detecting malwaic said method compnsing 
the steps of: 

ff(t) jjmaintaining a pending scan database stounsr data tdeiuifs msr computei files 
that ha\ e been v\ntten to a data stoiage de\ ice and loi v\ Inch a scan ioi malwaie has \ et 
to be performed: ffand]] 

j|(ii) jjasalow piiouts task within a multitasking em ironment conducting 
maiware scanmnu upon computer files identified withm said pending scan database a» 
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ha\in&j[en]] been written to the data .storage des Ice and for which the scan for maiware 
has yet to be performed ; and 

scan database, triggering scanning of said computer file as a high priority ta.sk with a first 
priority that is higher than a second priority of said low priority task, before permitting 
read access to said com puter file. 

1 0 {Ouirmai} \ method as claimed m elum ° funhei compusmg the step of as 4 
oomputei rile is written to a stotage de\ n.e adding data identify nit, said computet file to 
saul pending scan database 

11 (Cancelled) 

12. (Original) A. method as claimed in claim 9, further comprising maintaining a 
scanned file database storing data identifying computer files that have been scanned for 
maiware. 

1 1 (Original) <\ method as claimed m Limn 12 uhereui said data identity mg 
computes Hies that ha\e been scanned fo; maiware includes checksum data demed from 
said cent purer riles that wcie scanned 

14 (Cuiteuth Amended") \ method as claimed m claim U futthei eompn&m*!, the 
step ol m response to [[ajjsaid read request loi jjajjsairi computer file, detecting il said 
compute! File i» within said scanned file database,. ff and]] recalculating a checksum xalue 
H^ ; alcuiAted-fo? said computer rile and determining that sard recalculated e-hecksum 

y alue matches [[that | ja stoied checksum within said scanned fik daLiba.se before 
permitting said read request. 

1 5 {Original ) A method as claimed in claim 1 2, further comprising the step of upon 
startup detecting any computer riles stored on a storage dexiee not included within either 
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said pending scan database or said scanned file database and to add such computer files 
to said pending scan database. 

16. (Currently Amended) A method as claimed in claim 9, wherein said malware 
comprises one or more or: 

[[(i) Ha computet file infected with a computet \uus 
HOO j|aTroian; 

\\{in) {{& banned compute! file, and 

j f(s\ ) jja eompute? Hie containing banned content 

1 7 { Cut r end\ \ mended) Appasatus tos detecting malvutc, said apparatus 
comprising: 

Upending scan database logic operable to maintain a pending scan database 
storing data identify, mg computer tiles dust ha\ e been \\n (ten to a data storage device and 
for which a scan foi malware has set to be pesfoimed. [|and|| 

HUO a jjscdimljer jjmg logic operable as a km puouts task wuhm a multitasking 
ens ironment to conduct mahsare scanning upon computet files identified wuhm said 
pending scan database as haviugHenjj been yuiueii to the data storage dewee and fo? 
which the scan fo; mahsare has set to he pc; funned , and 

file lead i<\gK operahie in icsponsc to a read request for a computet illc identified 
within sard pending scan database to trigger s.iid scanning logic to scan said compute? tile 
as a htgh pnorm tasK svtth a first prion tv, that is highei than a second priority, of said low 
pnontv task, before puimttiug read access io said compute; fie 

\h {Ongtnal ) \pparatus as churned m claim 17, further eompusing iile s\nte logic 
operable as a computer file ts svutten to a stoiage device to add data identifying sard 
computer file to said pending scan database. 



19. (Cancelled) 
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20 (Ongm.ih \pp4tatus as claimed in claim J 7, furthei comprising .scanned file 
database logic opetabie to maintain a scanned Hie database stonng data identifs mg 
computet Hies thai ha\e been scanned lor malvune 

2! tOrigrndl) Appaiaats as claimed in claim 20 wherein said data rdennising 
compute! Hies that have been scanned for maluare includes checksum ckua denvcd from 
said computer files that were scanned. 

22. (Currently Amended) Apparatus as claimed in claim 21, [[further comprising]] 
wherem said file read logic is lurrher opeiable m response to j |a | |said read request for 
[[ajjsatd Lomputet flic to detected]] if said compute: iiie is wtthm said scanned file 
datdbase„[[and]] to tecakuiate ft checksum \ alue se^rtleulated-foi sanl computer file , and 
to determine that said recalculated checksum value matches ffthat]]d stoted checksum 
within said scanned file database beloie permitting said lead tequest 

23 (Original) apparatus as claimed m claim 2<> further comprising initiation logic 
opejahle upon staiksp to detect ,m\ eompuler files stojed on a stojage deuce not included 
within either said pending scan database oi said canned Hie database and to add such 
comptites Hies to said pendma scan database 

24 {( uj tenth Amended > \ppara(us as claimed m claim 17, uhetein sard malware 
comprises one or more of: 

[[(0 j ja computer file in fee led with a computet \ n us 

fp) ]]a Trojan; 

[[(iii) ]]a banned computer file; and 

j } ] ja compute! file costuming banned content 

2^ iCurretttls Amended) \ computet pi ogi dm product as claimed m claim I 
wherein an order or »aid eoroputei files identified within said pendmu scan database 
being st. aimed is based on an algorithm tltdi esinnaies the likelihood of [jdjj sard read 
request being performed on each computer file. 
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26. (Previously Presented) A. computer program product as claimed in claim 4, 
wherein only computer files determined to be clean from the maiware scanning are stored 

in the scanned file database. 

2"' <Pfe\ioush Picsentcd) \ compute: piogtam product as claimed in claim I, 
vdiciem an ouici of said compute i flies identified within said pending scan database 
being scanned is based on the order in which said computet tiles were placed in said 
pending scan database. 

2S. (New) A computer program product as claimed in claim } , wherein if said 
scanning code determines that said computer iiie is clean, said data identifying said 
computer file is removed from said pending scan database. 

29. {New} A computer program product as claimed in claim 1. wherein actions are 
triggered if said scanning code determines that said computer file is not clean. 

30. (New) A computer program product as claimed in claim 29, wherein said 
maiware actions include at least one of file cleaning, file quarantining, file deletion, and 
alert message issuing. 

3 1 . (New) A computer program product as claimed in claim I .. wherein said second 
priority of said low priority task is determined based on a predetermined time period. 



